Skip to main content
This lesson explains how routing works inside an AWS VPC. You’ll learn about the implicit VPC router, how route tables control traffic flow, route matching behavior (longest-prefix rule), common route targets, and how subnets are associated with route tables. Every VPC has an implicit router. That router has an interface in every subnet and is reachable at the subnet’s network address plus one (the first usable address). For example, for the subnet 192.168.1.0/24 the router’s interface in that subnet will be 192.168.1.1. The VPC router forwards traffic between subnets and between the VPC and external networks—just like a physical router in a data center.
A network diagram titled "Routing in VPCs" showing two availability zones each containing a public subnet (192.168.1.0/24). It depicts router interfaces and a VPC router (router IP 192.168.1.1) connecting the subnets to external networks.
The implicit VPC router is managed by AWS and is present in every VPC. You control its behavior by editing route tables that the router consults when forwarding packets.

​
Route tables and how they work

A route table is a collection of routes (rules). Each route contains:
  • a destination CIDR (the traffic’s destination),
  • a target (where to send matching traffic).
When an instance sends a packet outside its subnet, the VPC router:
  1. Looks up the route table associated with the subnet.
  2. Compares the packet’s destination IP against each route’s destination CIDR.
  3. Chooses the best match — the route with the longest prefix (most specific) if multiple routes match.
  4. Forwards the packet to the selected route’s target.
Matching behavior is identical for IPv4 and IPv6: the router selects the route whose CIDR contains the packet’s destination IP. For example, if both 10.0.0.0/16 and 10.0.1.0/24 match, traffic to 10.0.1.45 uses the /24 route because it is more specific.

​
Common route targets

All route tables include an implicit local route that covers the VPC CIDR block(s). If IPv6 is enabled, a separate IPv6 local route exists as well. These local routes cannot be removed and ensure instances inside the VPC can reach one another.

​
Examples and best practices

Example: a public subnet that needs internet access typically has a route like:
A private subnet that needs outbound internet access (but not inbound) will point 0.0.0.0/0 to a NAT Gateway:
Use separate route tables for different routing policies—e.g., one route table for public subnets (IGW target) and another for private subnets (NAT target). Multiple subnets can share the same route table, but each subnet can be associated with only one route table at a time.
Be careful with overlapping CIDRs and route entries. When multiple routes match, AWS always uses the route with the longest prefix (most specific). Also remember: a subnet can only be associated with a single route table at once.

​
Quick reference

  • Every VPC has a router with an interface in each subnet at the subnet’s network address + 1 (e.g., 192.168.1.1 for 192.168.1.0/24).
  • Route tables define how the router forwards traffic by matching destination CIDRs and forwarding to targets.
  • The router uses the most specific (longest prefix) matching route when multiple routes match.
  • A route’s target determines where the router forwards matching packets (IGW, NAT, peering, VGW, transit gateway, ENI, etc.).
  • Route tables always include a default local route (and an IPv6 local route if IPv6 is enabled).
  • Each subnet is associated with exactly one route table; a single route table can be associated with multiple subnets.
A presentation summary slide with a turquoise left panel and two numbered points on the right. The points state that route tables have a default local route (two if IPv6 is enabled) and that every subnet is associated with one route table.
Each VPC includes one default route table configured for you automatically.

Watch Video